More extensive tests and related bug fixes.

- Handle depth 0 trust anchors correctly.
- Discard signature verification errors from raw TA keys.

Feature: Support depth 0 CA with usage 0.